PatchTheCVEcaddy-security vulnerabilities and fixes
Recent CVEs affecting caddy-security, with upgrade or downgrade steps. 10 tracked.
Also searched as: caddy security.
caddy-security has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2024-02-17. Highest priority: CVE-2024-21495 (score 41/100).
- CVE-2024-21500 MEDIUM 4.8 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Exces
- CVE-2024-21499 MEDIUM 4.3 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the
- CVE-2024-21498 MEDIUM 5.3 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (
- CVE-2024-21497 MEDIUM 5.4 MITIGATE Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_u
- CVE-2024-21496 MEDIUM 6.1 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) vi
- CVE-2024-21495 MEDIUM 6.5 UPGRADE Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness
- CVE-2024-21494 MEDIUM 5.4 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoo
- CVE-2024-21493 MEDIUM 5.3 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array
- CVE-2024-21492 MEDIUM 4.8 MITIGATE All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expirati
- CVE-2023-52430 MEDIUM 6.1 DOWNGRADE The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XS
FAQ
How do I fix caddy-security vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is caddy-security being exploited right now?
None of the tracked caddy-security CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which caddy-security CVE should I patch first?
CVE-2024-21495 currently ranks highest (41/100): Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness.